Why Deleting a Mastodon Account Leaves Copies Elsewhere

When you press "Delete account" on Mastodon, your home server wipes your data, but it can only ask every other server to do the same. Nothing forces them to, and some will never hear the request at all.

That gap is the whole story. Here is what actually goes over the wire, who has copies of you, and what that means if you care about the data.

What the deletion message looks like

Mastodon speaks ActivityPub, where an account deletion is just another activity delivered to other servers' inboxes. Simplified, it looks roughly like this:

{
  "@context": "https://www.w3.org/ns/activitystreams",
  "id": "https://example.social/users/alice#delete",
  "type": "Delete",
  "actor": "https://example.social/users/alice",
  "to": ["https://www.w3.org/ns/activitystreams#Public"],
  "object": "https://example.social/users/alice"
}

The actor deletes themselves. A receiving Mastodon server reads it, checks it is genuine, and purges what it holds for that account. The key word is "purges what it holds": the message says nothing about how, or how thoroughly.

Who gets the message

Your server sends it to servers it already knows are interested, mainly those hosting your followers. That is a sensible optimisation, but it means the audience is a list, not the whole network.

A server that fetched one of your public posts through a boost, a reply or a search never followed you. It may not be on the list.

Five places a copy can survive

• Servers that were offline. Delivery is retried for a limited time, then dropped.
• Servers that never followed you. They cached your posts because someone else boosted them.
• Non-Mastodon software. ActivityPub is a protocol, and each implementation decides how seriously to take a Delete.
• Relays, archives and crawlers. Public posts are public; anyone can store them and nobody has to listen for deletions.
• Screenshots and quotes. Obviously no protocol reaches these.

Quick detour: why a Delete can't be a guarantee

Hang on, why not just make deletion mandatory? Because there is no central authority to enforce it. Each server is run by someone with their own software, backups and attitude, and the protocol only defines messages, not obligations.

It is the same reason you cannot recall an email. The sender's side is fully under your control; everyone else's is a matter of good manners and good software.

Media and search are separate problems

Mastodon servers cache remote images and video for a configurable period and then clear them. So even when a Delete is honoured late, media may linger until that clean-up runs.

Search is another layer. Full-text search is optional and indexes only what a server operator enables, but where it exists, its index is a second copy that has to be cleaned too. Well-behaved software does this; I would not assume every deployment does.

Your own server keeps things too

Even the home server is not a single deletion. Backups, as covered on this blog before, are written on a schedule and restored whole, so a restored backup can resurrect the account until the deletion is replayed. Ask your instance admin about their retention and restore practice.

Where UK law comes in

Under UK GDPR, the right to erasure is in Article 17, and ICO guidance explains how it is applied. That is legislation and regulator guidance respectively; what follows is my own reading, and it depends on circumstances.

• A server operator who is a controller for your data has to consider an erasure request, subject to the exceptions in the Act.
• Where a controller has made personal data public and is obliged to erase it, Article 17(2) asks for reasonable steps to tell other controllers. Sending the Delete activity looks like exactly that kind of step.
• Whether a hobbyist server on the other side of the world counts as being within UK GDPR reach is a separate, fact-heavy question. Do not assume it is easy to enforce.
• Purely personal or household use by an individual may fall outside UK GDPR altogether, which matters for small instances.

What to do if you actually want to disappear

1. Delete or edit sensitive posts before deleting the account, so the update messages go out while your account is still live.
2. Delete the account and let the Delete activity federate.
3. Contact admins of larger servers that you know hold copies and ask them to purge manually.
4. Search for yourself on a few unrelated instances and check what still shows.

Treat anything you posted publicly as published. Deletion removes your copy and sends a request for the rest; the honest summary is that it works well in the common case and not at all in the cases that matter most.